feat(core): allow observer roles to manage group unions

* extended privileges to manage group unions allowing observer roles on operand groups

Author: Johaney-s

apps/admin-gui/src/app/shared/components/dialogs/create-relation-dialog/create-relation-dialog.component.ts

@@ -87,10 +87,10 @@ export class CreateRelationDialogComponent implements OnInit {
   private setGroupsToDisable(): void {
     for (const group of this.groups) {
       if (
-        !this.guiAuthResolver.isAuthorized('createGroupUnion_Group_Group_policy', [
+        !this.guiAuthResolver.isAuthorized('result-createGroupUnion_Group_Group_policy', [
           this.data.group,
-          group,
-        ])
+        ]) ||
+        !this.guiAuthResolver.isAuthorized('operand-createGroupUnion_Group_Group_policy', [group])
       ) {
         this.groupsToDisable.add(group.id);
       }

libs/perun/components/src/lib/groups-list/groups-list.component.ts

@@ -332,10 +332,10 @@ export class GroupsListComponent implements AfterViewInit, OnChanges {
       return this.selection.selected.reduce(
         (acc, grp) =>
           acc &&
-          this.authResolver.isAuthorized('removeGroupUnion_Group_Group_policy', [
+          this.authResolver.isAuthorized('result-removeGroupUnion_Group_Group_policy', [
             this.parentGroup,
-            grp,
-          ]),
+          ]) &&
+          this.authResolver.isAuthorized('operand-removeGroupUnion_Group_Group_policy', [grp]),
         true
       );
     } else if (this.authType === 'vo-groups') {